CVE-2026-105207 Overview
CVE-2026-105207 is an authentication bypass vulnerability in ZITADEL, an open-source identity and access management platform. The flaw allows an unauthenticated attacker who knows a victim's login name to link their own external identity provider (IdP) identity to the victim's account. Once linked, the attacker signs in as the victim through the external IdP, achieving full account takeover. The vulnerability affects ZITADEL versions 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3. The weakness is categorized as Missing Authentication for Critical Function [CWE-306].
Critical Impact
Unauthenticated attackers can bind their external IdP identity to any user account knowing only the login name, resulting in full account takeover without credentials or MFA.
Affected Products
- ZITADEL 3.0.0 through 3.4.15
- ZITADEL 4.0.0 before 4.17.3
- Login V2 identify-only sessions and User Service V2 AddIDPLink endpoint
Discovery Timeline
- 2026-10-04 - CVE-2026-105207 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-105207
Vulnerability Analysis
ZITADEL creates links between internal user accounts and external identity providers without first verifying a primary authentication factor or validating the caller's permission to perform the operation. The flaw exists in two code paths: identify-only Login V2 sessions and the User Service V2 AddIDPLink endpoint. Both allow callers to attach an external IdP identity to a target user account without proving ownership of that account.
After the link is established, the authentication flow trusts the external IdP assertion as proof of identity for the targeted ZITADEL user. The attacker then logs in through their own IdP account and receives a session as the victim.
Root Cause
The root cause is missing authentication on a security-critical state change [CWE-306]. The link-creation operation should require either an authenticated session owned by the target user or an administrative caller with explicit permission. ZITADEL enforced neither check on the vulnerable code paths, treating identification of the target user as sufficient authorization to modify its federated identity bindings.
Attack Vector
An attacker needs network access to the ZITADEL instance and knowledge of a victim's login name, which is often enumerable or publicly known. The attacker invokes AddIDPLink or completes an identify-only Login V2 flow that associates their own external IdP identity with the victim's account. The attacker then authenticates to the configured external IdP under their own identity and is logged into ZITADEL as the victim. No prior credentials, tokens, or user interaction from the victim are required.
No verified exploit code is published. See the GitHub Security Advisory and VulnCheck Advisory on Zitadel for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-105207
Indicators of Compromise
- New entries in the ZITADEL audit log showing IDPLink additions to user accounts that did not originate from an authenticated self-service action by the account owner.
- Successful logins immediately preceded by an external IdP link event on the same account within a short time window.
- External IdP identities (subject identifiers) linked to multiple distinct ZITADEL users, especially administrative accounts.
- Login V2 sessions that transition from identify-only state directly into IdP link creation without a password or MFA step.
Detection Strategies
- Query ZITADEL event history for human.user.idp.link.added and related IDP link events, correlating with the actor identifier to flag links not performed by the account owner.
- Alert when a user account gains a new federated identity binding followed by a login from that IdP within minutes.
- Baseline the normal rate of IdP link operations per tenant and alert on spikes consistent with scripted abuse.
Monitoring Recommendations
- Forward ZITADEL audit events to a centralized log platform and retain them for at least 90 days to support retrospective hunts.
- Monitor the User Service V2 AddIDPLink endpoint at the API gateway for unauthenticated or anomalous callers.
- Review all accounts with external IdP links added between the vulnerable release window and the upgrade to a patched version.
How to Mitigate CVE-2026-105207
Immediate Actions Required
- Upgrade ZITADEL to version 4.17.3 or later for the 4.x branch. Users on the 3.x branch should migrate to a fixed 4.x release, as 3.x versions through 3.4.15 are affected.
- Audit all external IdP links created on affected versions and remove any that cannot be attributed to a legitimate owner-initiated action.
- Force password resets and session revocation for accounts with suspicious IdP link history.
- Rotate administrative credentials and review admin account IdP bindings first.
Patch Information
The vendor fix is included in ZITADEL 4.17.3. The patched code enforces a primary factor check and caller permission validation before creating a link between an internal user and an external IdP identity. Refer to the GitHub Security Advisory GHSA-g8gj-gq47-xgf4 for the full remediation details.
Workarounds
- Disable self-service external IdP linking in ZITADEL policy until patched.
- Restrict network access to the ZITADEL API, particularly the User Service V2 endpoints, to known administrative sources.
- Temporarily disable external IdP authentication providers if upgrade cannot be performed immediately.
- Require administrative approval for all new IdP link operations through policy configuration.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
